Enterprise backups: restic, Borg and immutable backups
You build deduplicated, encrypted, remote backup repositories with restic and Borg and put retention policy, immutable copies and ransomware-resistant design into practice.
Level 301 · 16 lessons · 15 practice labs
Lessons
Modern tools
- Deduplication and client-side encryption
- Repositories, archives and compression with Borg
- Repositories and backends with restic
- Short task: back up the same data with both tools and compare size and time
Policy
- Retention policy: forget, prune and trade-offs
- RPO and RTO: how much data, how much time
- Checking repository integrity
- Short task: design a policy that fits legal retention and the disk budget
Resilience
- Off-site, pull-model backups: so the source can't delete them
- Append-only mode and immutable copies
- Backup keys: lose them and you lose everything
- A ransomware scenario: do the backups survive
- Short task: build a backup setup a compromised server can't delete
Wrap-up
- Large restores: prioritising and speed
- Backup reporting and audit readiness
- Capstone: an encrypted, off-site, immutable backup system for a three-server company
Practice labs
- Create an encrypted backup repository and take a first backup: Create an encrypted borg repository on the backup server, take the first archive and report the deduplicated size.
- Restore one directory from a restic snapshot: List snapshots by tag and date and restore only one directory from last week's snapshot to a separate target.
- Mount the repository and trace a file's history: Mount the repository as a file system, find the archive in which a config file changed and bring back the version before the change.
- Apply a retention rule with a dry run: Review a keep-seven-daily, keep-four-weekly rule with a dry run first, then apply it and compact the repository.
- Draw up an RPO and RTO table for services: For five services at Mercanköşk Otelcilik set acceptable data loss and downtime and map backup frequency to them.
- Fix backup scope for excess and missing data: Exclude caches that bloat the backup, add a data directory left out of scope and document the measured effect of the change.
- Make the backup repository append-only: Limit the client key to append-only mode and show an attempt to delete archives from the client is refused.
- Check repository integrity and find the bad archive: Run a data-verifying check on the repository, identify the archive affected by a corrupt chunk and report the repair options.
- Make backups resilient to a compromised server: Switch from the server pushing backups to the backup server pulling them, separate delete rights and test that old archives stay protected.
- Create a second copy of the backup repository: Sync the backup repository to a second target and verify both copies list the same archives.
- Limit backup transfer by bandwidth and hours: Put a rate limit on a backup transfer that saturates a branch link, run it only in the night window and show an interrupted run resumes.
- Back up the repository key and test a loss scenario: Export the repository key and store it safely, then on a client whose key was deleted restore the key from backup and reach the archive.
- Report the age of the last successful backup: Query the repository for each server's last successful archive date and list those older than twenty-four hours.
- Measure repository growth and estimate when it fills: Compute daily growth from the deduplicated sizes of the last thirty archives and estimate when the disk will fill.
- Build a monitored backup setup for three servers end to end: Build a setup that backs three servers up to an encrypted repository, prunes, verifies weekly and reports lateness, and prove it with a restore.
About this course
You build deduplicated, encrypted, remote backup repositories with restic and Borg and put retention policy, immutable copies and ransomware-resistant design into practice.
What you will learn
- Modern tools
- Policy
- Resilience
- Wrap-up
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.